Archiv für den Monat: November 2022

Recommendation: curate a list of speaking engagements

Veröffentlicht am von
Antworten

Something I learned from HalvarFlake in 2019 that it can be quite painful to remember what conference one spoke in the past.

Giving a talk at a conference, event or appearing on a podcast is a big service for the community, who can learn from your experience. At the same time it is a testament to your impact and something to be proud of. It is cool to look back where you spoke 5 years ago and what topics you found relevant back then.

Such a list can be useful when trying to get a new job or to get more attention from hiring managers. It can serve to show your expertise in a specific field. Last but not least it can help future program committees in a paper review process to see your speaking abilities (if the review is not done blindly).

It also can prevent or reduce the risk of burnout. Seeing how much you spoke in the past gives you the ability to reflect the workload, additional workload added by preparing a talk which is usually forgotten when agreeing to speak. If you felt comfortable giving 5 talks a year, you might be well off giving 6. Agreeing on 15 however might be a big step up and should be done very carefully.

Since then I capture my speaking at a page of my page. I recommend you do the same every 6 months.

Items I recommend to capture:

  • Date of talk / podcast
  • Conference title
  • Talk title
  • Link to slides if available
  • Link to a recording if available
  • Link to blogpost from others covering your talk

#FIRSTCTI22 FIRST CTI Event Berlin 2022 Review

Veröffentlicht am von
Antworten

It is November 9th 2022 and I had a few days to digest and think about the FIRST CTI event taking place in Berlin from 2022-11-01 to 2022-11-03.

You can find more direct feedback and impressions on Twitter with the hashtag #FIRSTCTI22 where I also shared stuff.

The program is published at https://www.first.org/events/symposium/berlin2022/program. So let’s dive into my thoughts.

To give some context, I participated in the first FIRST CTI, called FIRST Technical Colloquium on Threat Intelligence, hosted by Siemens in 2016. Back then the topic was very new (remember STIX/CybOX, Mantis). But some topics were relevant already back then like how to operationalize Threat Intelligence and how to evaluate information. It was great then and I was excited to see what has changed since then.

Training

As I only arrived on Tuesday, I had to skip the trainings, but I was able to talk to participants with mixed impression, which is no surprise given the different roles / background of the participants (more on that later) so I hope many of them provide feedback to the event team so they can extract the right learnings on which training is best suited for the audience.

Wednesday

I had the honor to moderate the Wednesday, so while I was able to hear all talks, I had to also focus on logistics, take time and have some questions ready for the speakers. To my surprise the audience did not take that much advantage of the fact that we were all in one room and asked very few questions. Maybe this is something which we need to re-learn after the pandemic?

I really liked the talk from James Chappell „Ten Years of Cyber Threat Intelligence: Retrospectives“. It was a perfect entry and set the stage for the two following days and for sure James is a veteran in the field, so there were several observations that stuck with me.

Next up was another highlight for me: „Crossing the Cyber Sad Gap“ from Jake Nicastro. Jake went into the risk of our jobs and how it can affect the mental health and offered some points to take home and address in your team, very eye opening and I am sad that this talk will not be made available to the public.

Another thing I want to highlight is the mixture at the event between practitioners and academia, Clemens Sauerwein from the University of Innsbruck, Department of Computer Science, AT presented on stage and there were several delegates who were really interested in conversation with industry and public sector people.

Obviously I was nervous giving my own talk together with tomchop, but I think it went really well.

Overall Wednesday was a really pleasant mixture of topics.

Audience

Overall the audience was a little over 330 delegates. From conversations I would assume around 40 % with a DFIR background, 40 % from CTI related roles and 20 % either a mixture or something else, but I guess the organizers have better stats on this.

The size of the audience felt ideal for me as well. There were enough people to run into random people to start a conversation but it was not too large to get lost, I think sub 400 is ideal.

There were delegates from all kinds of regions, with a majority coming from Europe, which is not a surprise given the event location. To build a reputation I would like to see the event happen again in Berlin, if there is demand to have something similar in other regions like AMER or APAC, I would suggest building local forks vs. Rotating over the planet like FIRST does for the annual conference. That should also make it easier for the planning team to figure out logistics, but again is my personal opinion and there are also advantages for changing locations.

Length

Personally I prefer events under three days. Longer events make me tired and come with too much social toll for me. Two days still enable follow up and enough opportunities to have conversations going a little deeper then „hey my name is John Doe, I work at XYZ, nice to meet you“ and then never see that person again.

Thursday

Started with another excellent talk about the human aspect of our industry „Why Your Security Analysts Are Leaving and What You Can Do to Retain Them“ by Thomas Kinsella, I highly recommend this talk.

I skipped one talk that was pre-recorded and instead spent my time networking with delegates, as I hope to see the talk afterwards on YouTube instead.

It is always nice to see new tools announced at events, same here, when „ORKL: Building an Archive for Threat Intelligence History“ was covered by Robert Haist. Solid talk and I recommend checking out the project web page and reaching out to Robert if you want to help the project.

The rest of the talks were all solid but I do not want to bother you with all my thoughts, I have provided feedback to the events team and I recommend you doing the same (check your mails for the survey).

The program committee did an excellent job setting up a program that catered for technical and strategic folks. Kudos: @thomasschreck_ , @adulau , @asfakian, James Chappell and Dr. Morton Swimmer.

Dinner

An important aspect of such events for me is to meet with old friends but also make new connections and introduce new people to the community. This time I tried to execute something I learned from Kate.

I made (or asked someone to make one) reservation in a restaurant nearby for 6-8 people, asked 2-4 people I already know and want to see again and added people I wanted to meet for a long time and or folks who asked to be introduced.

The result: a great combination of nice food, excellent group sizes to have different topics to talk about but not too large that it would go nowhere or someone would feel lost (at least I hope).

The absolute highlight for me was going to C-Base, if you have never heard about it, make sure to check it out, I will not spoil it here. Thanks Y.W. For your hospitality my friend.

Wish

If I had one wish for the future of that event, I would hope to have a more diverse audience and speakers. We as the community need to push more and improve.

Disclaimer

I have not been involved in the planning of the event other than setting a draft budget in November / December 2021 as part of the normal FIRST budgeting process. And above is purely my personal opinion on things.

Photocredit: Kamil Bojarski

Practical Doomsday: A User’s Guide to the End of the World

Veröffentlicht am von
Antworten

I have posted about this book a couple of times on Twitter before I realized I should just write down my thoughts.

TLDR: The book of Michael Zalwski is worth a read. It does not over hype the topic and does not try to fuel fear but bring attention to topics that are realistic to prepare a plan for.

The book starts with an introduction to risk, goes into setting boundaries to fictional scenarios and goes over some realistic cases that are more likely to happen.

Part II then goes into practical tips, especially by starting with a “rainy-day find”. While that is not possible for everyone, every following topic might be even harder to achieve. The section about “Getting in shape” greatly reminds me of the movie Zombieland rule #1 “#1: Cardio – When the virus struck, for obvious reasons, the first ones to go were the fatties.”.

Because this is not the first book about the topic, the third part, while not completely new, I would still consider it a good collection of achievable things one can do and should consider and follows an order of importance, starting with water.

The last part “Active self-defense” was the least interesting for me, but again, the author put enough disclaimer to it that there might be ways to avoid situations where you e.g. would need a firearm.

You can tell that the author has not only spent considerable time researching the topic but also applied various techniques in real life. If you only want to read one book and have already read and implemented the guidelines governments usually publish to their citizens to be prepared for emergencies, this book is good from a content perspective as well as easy to read and digest and implement.

Recommendation: If you are going to buy the book, maybe buy the hardcover, you do not want your disaster plan to be dependent on an electronic device, do you?

(The link above is an Amazon partner link)

You can also read a preview chapter at: https://lcamtuf.coredump.cx/prep/preview